The following TQL queries are Bro DNS queries.
Identify internal systems attempting to resolve domains containing "domain.com" in a specific country
class:bro_dns srcisp:"private ip address lan" domain:"domain.com" srcisp:"private ip address lan" domain:"domain.com" dstcountrycode:cn
Identify frequently requested DNS domain names
class:bro_dns not srcport:137 | groupby domain
Identify infrequently requested DNS domain names (may require tuning)
class:bro_dns not srcport:137 not domain:"in-addr.arpa" not domain:"ip6.arpa" | groupby < domain 1000